harden collision router sentinel free-address guards

README.md

@@ -46,12 +46,13 @@ The supervisor collision router converged in doctrine before it converged in byt
 - rule: a collision is only an error after classification
 - head guard: non-`COLLISION` HBP rows are held, not routed as collisions
 - precedence: runtime-bound fields (`os_pid`, `process_id`, `runtime_pid`, `port`, `flywheel_slot`, `port_port`) classify as REAL before any logical label
-- sentinel runtime values (`none`, `null`, `false`, `0`, empty, etc.) are absent and do not override logical labels
+- sentinel and zero-equivalent runtime values (`none`, `null`, `false`, `0`, `0.0`, `00`, `+0`, `-0`, empty, etc.) are absent and do not override logical labels
+- free-address fields must pass the same presence check before a real collision can become reroute-ready; `-`, `0`, `none`, `null`, `false`, and zero-equivalents stay blocked
 - token inference is boundary-aware, so `fireworker` does not match `worker`
 - fallback token inference only reads dedicated classification fields (`kind`, `type`, `layer`, `class`, `role`, `scope`, `agent_kind`, `agent_type`, `collision`), not freeform names/routes/reasons
 - canonical logical vocabulary includes `supervisor`, `prof`, `professor`, and `council`; `write` is deliberately not a logical inference token
 - verdicts: logical preserve, real block until free address, real reroute draft when a free address is attested, mixed split
-- verification: `node --check`, CLI `--self-test` (`13/13`), and the portable test pyramid: unit (`14/14`), integration (`3/3`), suite (`8/8`), system (`3/3`), fabric-contract (`4/4`)
+- verification: `node --check`, CLI `--self-test` (`15/15`), and the portable test pyramid: unit (`16/16`), integration (`3/3`), suite (`8/8`), system (`3/3`), fabric-contract (`4/4`)
 
 ## Authority
 

README.md.sha256

@@ -1 +1 @@
-D12095AB7839D595727EA681BA67C01A0DF628C25F518144BFB0B212DD42DCC0  README.md
+0BC38BAB2EAE126EE0F66CF6444B46125269D07031C74B1C7705580A39605299  README.md

specs/SUPERVISOR-COLLISION-ROUTER-SPEC.hbp

@@ -3,7 +3,7 @@ LAW|rule=collision-is-only-error-after-classification|composes=LAW-ASOLARIA-NEUR
 INPUT|primary=HBP-row-string|shape=COLLISION|fields=agent_system+kind+role+os_pid+process_id+runtime_pid+port+flywheel_slot+port_port+free_hilbert+free_real_address|json=0
 INPUT|compat=JS-object-accepted-by-normalizeCollisionInput|status=compat-only-not-bilateral-wire|json=0
 CLASSORDER|step=0|rule=head-must-be-COLLISION-or-OBJECT-compat|non_collision_heads=HELD_NON_COLLISION_HEAD|json=0
-CLASSORDER|step=1|rule=runtime-bound-fields-win-REAL-before-any-logical-label|fields=os_pid+process_id+runtime_pid+port+flywheel_slot+port_port|sentinels_absent=empty+0+none+null+false+undefined+na+n/a+dash|json=0
+CLASSORDER|step=1|rule=runtime-bound-fields-win-REAL-before-any-logical-label|fields=os_pid+process_id+runtime_pid+port+flywheel_slot+port_port|sentinels_absent=empty+0+none+null+false+undefined+na+n/a+dash|zero_equivalents_absent=0.0+00+plus0+minus0+0x0|json=0
 CLASSORDER|step=2|rule=explicit-agent_system-logical-or-real|logical_state=LOGICAL_AGENT_COLLISION_ALLOWED|real_state=REAL_AGENT_NO_COLLISION_REQUIRED|json=0
 CLASSORDER|step=3|rule=evidence-token-inference-boundary-aware-not-substring-and-dedicated-fields-only|fields=kind+type+layer+class+role+scope+agent_kind+agent_type+collision|ignored_freeform=agent+front+address+route+reason+subject+required+action|mixed=real-and-logical-markers-held-for-split|examples=fireworker-does-not-match-worker;agent_sup-dan_omniflywheel_router_does-not-infer-real|json=0
 SCRVOCABREAL|canonical=real_agent+real-agent+realagent+runtime+physical+process+process_backed+daemon+free_agent+free-agent+shelless+worker+pid_runtime+runtime_pid+port.port+omniflywheel+revolver|json=0
@@ -13,12 +13,13 @@ CLASSORDER|step=4|rule=unclassified-held-for-file-level-review|no_guessing=1|jso
 VERDICT|logical=LOGICAL_COLLISION_PRESERVED_ROUTE_TO_SUPERVISOR|ok=1|target_router=logical-overlay-router|target_route=/api/constructions/atlas/system/council/dispatch-plan|json=0
 VERDICT|real_without_free_address=REAL_COLLISION_BLOCKED_NEEDS_FREE_ADDRESS|ok=0|target_router=real-runtime-address-router|target_route=/api/omniflywheel|gate=operator-pair-cosign-before-real-mint-or-launch|json=0
 VERDICT|real_with_free_address=REAL_COLLISION_REROUTE_READY_DRAFT|ok=1|target_router=real-runtime-address-router|target_route=/api/omniflywheel|gate=operator-pair-cosign-before-real-mint-or-launch|json=0
+FREEADDRESS|rule=free-address-fields-must-pass-presentValue-before-reroute-ready|fields=free_real_address+free_hilbert+next_free_hilbert+target_free_range+free_range|blocked_if=empty+0+0.0+00+plus0+minus0+none+null+false+undefined+na+n/a+dash|valid_example=1604-1621|json=0
 VERDICT|mixed=MIXED_COLLISION_HELD_SPLIT_REQUIRED|ok=0|required=emit-separate-logical-and-real-HBP-rows-before-routing|json=0
 VERDICT|unclassified=UNCLASSIFIED_COLLISION_HELD|ok=0|required=add-agent_system-real-or-logical-or-review-source-diff|json=0
 OUTPUT|plan_rows=SUPCOLLIDEHDR+SUPCOLLIDEROUTE+SUPCOLLIDEGATES|row_format=HBP|json_object_on_wire=0|json=0
 SAFETY|mutates=0|executable=0|mints=0|launches=0|usb_writes=0|engine_edits=0|json=0
-VERIFY|required=node--check-router+router-cli-selftest-13of13|unit=14of14|integration=3of3|suite=8of8|system=3of3|fabric_contract=4of4|all_repo_tests=32of32|json=0
+VERIFY|required=node--check-router+router-cli-selftest-15of15|unit=16of16|integration=3of3|suite=8of8|system=3of3|fabric_contract=4of4|all_repo_tests=34of34|json=0
 CONVERGENCE|recommendation=acer-adopt-liris-HBP-row-input+4-state-real-taxonomy+unit-test-file|byte_convergence=copy-this-source-or-rebuild-to-this-spec-then-compare-sha256|json=0
-HARDENING|source=liris-adversarial-review+acer-confirmed-inherited-bugs+acer-real-office-system-probe|fixes=non_collision_head_guard+boundary_token_matching+runtime_sentinel_absent+freeform_identity_token_ignored|json=0
+HARDENING|source=liris-adversarial-review+acer-confirmed-inherited-bugs+acer-real-office-system-probe+acer-adversarial-sweep-wf_27029b9b|fixes=non_collision_head_guard+boundary_token_matching+runtime_sentinel_absent+zero_equivalent_runtime_absent+free_address_sentinel_guard+freeform_identity_token_ignored|json=0
 VOCABDELTA|source=acer-poc+operator-decision|logical_add=supervisor+prof+professor+council|logical_remove=write|proof=acer_pyramid_29of29+liris_local_unit_14of14+cli_13of13+combined_18of18|json=0
 END|state=SPEC_READY_FOR_BILATERAL_CONVERGENCE_HARDENED|json=0

specs/SUPERVISOR-COLLISION-ROUTER-SPEC.hbp.sha256

@@ -1 +1 @@
-FFF159B2D3643047BF55BFA8255A66AAA104ED9CFDF8C8FA1A3FB9160E1131F1  SUPERVISOR-COLLISION-ROUTER-SPEC.hbp
+DB7D0E870A9DC4EE8E171B2948825EBE3BED63F1ABF92650BEC028C1D15404B3  SUPERVISOR-COLLISION-ROUTER-SPEC.hbp

tests/supervisor-collision-router.unit.test.mjs

@@ -56,6 +56,15 @@ test('sentinel runtime values are absent and do not override logical labels', ()
   assert.equal(plan.state, 'LOGICAL_COLLISION_PRESERVED_ROUTE_TO_SUPERVISOR');
 });
 
+test('numeric-zero-equivalent runtime values are absent', () => {
+  for (const value of ['0.0', '00', '+0', '-0', '0x0']) {
+    const plan = planCollisionRoute(`COLLISION|agent_system=logical|role=supervisor|port=${value}|json=0`);
+    assert.equal(plan.ok, true, value);
+    assert.equal(plan.classification, 'LOGICAL_AGENT', value);
+    assert.equal(plan.state, 'LOGICAL_COLLISION_PRESERVED_ROUTE_TO_SUPERVISOR', value);
+  }
+});
+
 test('real collision can become draft-ready with an attested free range', () => {
   const plan = planCollisionRoute('COLLISION|agent_system=real|kind=free_agent|free_hilbert=1604-1621|json=0');
   assert.equal(plan.ok, true);
@@ -63,6 +72,21 @@ test('real collision can become draft-ready with an attested free range', () =>
   assert.match(plan.required, /1604-1621/);
 });
 
+test('sentinel and zero-equivalent free addresses do not unblock real collisions', () => {
+  for (const field of ['free_real_address', 'free_hilbert', 'next_free_hilbert', 'target_free_range', 'free_range']) {
+    for (const value of ['-', '0', '0.0', '00', '+0', '-0', 'none', 'null', 'false']) {
+      const plan = planCollisionRoute(`COLLISION|agent_system=real|kind=free_agent|${field}=${value}|json=0`);
+      assert.equal(plan.ok, false, `${field}=${value}`);
+      assert.equal(plan.classification, 'REAL_AGENT', `${field}=${value}`);
+      assert.equal(plan.state, 'REAL_COLLISION_BLOCKED_NEEDS_FREE_ADDRESS', `${field}=${value}`);
+    }
+  }
+  const livePort = planCollisionRoute('COLLISION|port=4949|free_real_address=-|json=0');
+  assert.equal(livePort.ok, false);
+  assert.equal(livePort.classification, 'REAL_AGENT');
+  assert.equal(livePort.state, 'REAL_COLLISION_BLOCKED_NEEDS_FREE_ADDRESS');
+});
+
 test('token inference uses boundaries instead of substrings', () => {
   const plan = planCollisionRoute('COLLISION|role=fireworker|json=0');
   assert.equal(plan.ok, false);

tests/supervisor-collision-router.unit.test.mjs.sha256

@@ -1 +1 @@
-5854AD9E0A364CEFAE7730A30479660F31B19D9C2E95D432FEF65CF163320BFF  supervisor-collision-router.unit.test.mjs
+C6918820C58ED52939643A82E17D055EBC4F0ED78A4604BB464CA607AEAA2D3F  supervisor-collision-router.unit.test.mjs

tools/behcs/supervisor-collision-router.hbi

@@ -2,4 +2,4 @@ SUPCOLLIDEROUTERINDEX|host=liris|target=supervisor-collision-router.hbp|tool=sup
 INDEXROW|row=1|kind=hdr|state=collision_classifier_declared|json=0
 INDEXROW|row=3|kind=logical|route=/api/constructions/atlas/system/council/dispatch-plan|json=0
 INDEXROW|row=4|kind=real|route=/api/omniflywheel|json=0
-INDEXROW|row=7|kind=verify|state=node_check+unit_14of14+combined_18of18+cli_13of13_pass|hardening=head_guard+boundary_tokens+runtime_sentinels+freeform_identity_ignored+canonical_vocab_delta|vocab=logical_add_supervisor_prof_professor_council_remove_write|runtime_bound_precedence=REAL_before_logical_label|json=0
+INDEXROW|row=7|kind=verify|state=node_check+unit_16of16+combined_20of20+cli_15of15_pass|hardening=head_guard+boundary_tokens+runtime_sentinels+zero_equivalent_runtime_absent+free_address_sentinel_guard+freeform_identity_ignored+canonical_vocab_delta|vocab=logical_add_supervisor_prof_professor_council_remove_write|runtime_bound_precedence=REAL_before_logical_label|json=0

tools/behcs/supervisor-collision-router.hbi.sha256

@@ -1 +1 @@
-F8ECF8D3F91C13529159273877502236BD91664E8FD136327CD72B326B113794  supervisor-collision-router.hbi
+97AD9A83BA77C6BE5AE1C7E5D781C79EA5F2541E0F456540B89B94A302DB0CD9  supervisor-collision-router.hbi

tools/behcs/supervisor-collision-router.hbp

@@ -4,6 +4,6 @@ SUPCOLLIDEROUTERSYSTEM|kind=LOGICAL|members=supervisors+profs+roles+reasoners+se
 SUPCOLLIDEROUTERSYSTEM|kind=REAL|members=runtime_pid+process_backed+free_agent+omniflywheel_port_port|collisions=BUGS|action=BLOCK_UNTIL_FREE_REAL_ADDRESS|dispatch=omniflywheel|route=/api/omniflywheel|json=0
 SUPCOLLIDEROUTERBRIDGE|kind=SURFACE_TRANSLATION|router=tools/behcs/omnidirectional-translator-router.mjs|when=surface_or_fabric_endpoint_bridge_needed|state=PLANNED_OR_EXISTING_PAIRS_ONLY|json=0
 SUPCOLLIDEROUTERVERDICT|logical=LOGICAL_COLLISION_PRESERVED_ROUTE_TO_SUPERVISOR|real_without_free_address=REAL_COLLISION_BLOCKED_NEEDS_FREE_ADDRESS|real_with_free_address=REAL_COLLISION_REROUTE_READY_DRAFT|mixed=MIXED_COLLISION_HELD_SPLIT_REQUIRED|json=0
-SUPCOLLIDEROUTERVERIFY|syntax=node_check_PASS|unit=node_test_14of14_PASS|combined_translator_router_tests=18of18_PASS|cli_selftest=13of13_PASS|hardening=non_collision_head_guard+boundary_token_matching+runtime_sentinel_absent+freeform_identity_token_ignored|canonical_vocab=logical_add_supervisor_prof_professor_council_remove_write|runtime_bound_precedence=os_pid_port_flywheel_REAL_before_logical_label|rows=HBP_ONLY|mutates=0|mints=0|launches=0|usb_writes=0|engine_edits=0|json=0
-SUPCOLLIDEROUTERSHA|mjs_sha256=BA2E47CFA83CA1AB0DF56ABE43493C6CD88DB6DDCFC2AFA258BCEA8A77F836DC|test_sha256=5854AD9E0A364CEFAE7730A30479660F31B19D9C2E95D432FEF65CF163320BFF|translator_router_sha256=DDE1A74CF3D4D055D536935CF50179748B3304EA4735EE4541AD56FAD38273F5|json=0
+SUPCOLLIDEROUTERVERIFY|syntax=node_check_PASS|unit=node_test_16of16_PASS|combined_translator_router_tests=20of20_PASS|cli_selftest=15of15_PASS|hardening=non_collision_head_guard+boundary_token_matching+runtime_sentinel_absent+zero_equivalent_runtime_absent+free_address_sentinel_guard+freeform_identity_token_ignored|canonical_vocab=logical_add_supervisor_prof_professor_council_remove_write|runtime_bound_precedence=os_pid_port_flywheel_REAL_before_logical_label|rows=HBP_ONLY|mutates=0|mints=0|launches=0|usb_writes=0|engine_edits=0|json=0
+SUPCOLLIDEROUTERSHA|mjs_sha256=E1B01511D0F141842805C6404921DD095753670A38B003FE0746B6B31B918D62|test_sha256=C6918820C58ED52939643A82E17D055EBC4F0ED78A4604BB464CA607AEAA2D3F|translator_router_sha256=DDE1A74CF3D4D055D536935CF50179748B3304EA4735EE4541AD56FAD38273F5|json=0
 SUPCOLLIDEROUTEREND|state=READY_DRAFT_NO_EXECUTION|json=0

tools/behcs/supervisor-collision-router.hbp.sha256

@@ -1 +1 @@
-DE684BE5E511D57F9F19CE6EBA232B04B538B9C17FD40FED75B413D56A6C6737  supervisor-collision-router.hbp
+DFD0A20E0D2F0C75AA760FF47D02DE4916A0768FABC716C86F3D7C3B5A22DA5F  supervisor-collision-router.hbp

tools/behcs/supervisor-collision-router.mjs

@@ -102,7 +102,11 @@ function truthy(value) {
 const SENTINELS = new Set(['', '0', 'none', 'null', 'false', 'undefined', 'na', 'n/a', '-']);
 
 function presentValue(value) {
-  return !SENTINELS.has(lowerValue(value));
+  const lowered = lowerValue(value);
+  if (SENTINELS.has(lowered)) return false;
+  const numeric = Number(lowered);
+  if (Number.isFinite(numeric) && numeric === 0) return false;
+  return true;
 }
 
 function escapeRegExp(value) {
@@ -293,7 +297,10 @@ function hasSurfaceBridge(fields) {
 }
 
 function freeRealAddress(fields) {
-  return fields.free_real_address || fields.free_hilbert || fields.next_free_hilbert || fields.target_free_range || fields.free_range || '';
+  for (const key of ['free_real_address', 'free_hilbert', 'next_free_hilbert', 'target_free_range', 'free_range']) {
+    if (presentValue(fields[key])) return cleanValue(fields[key]);
+  }
+  return '';
 }
 
 export function planCollisionRoute(input) {
@@ -459,9 +466,25 @@ export function selfTest() {
     sentinelRuntime.classification === 'LOGICAL_AGENT' &&
     sentinelRuntime.state === 'LOGICAL_COLLISION_PRESERVED_ROUTE_TO_SUPERVISOR');
 
+  const zeroEquivalentRuntime = ['0.0', '00', '+0', '-0', '0x0'].map((port) =>
+    planCollisionRoute(`COLLISION|agent_system=logical|role=supervisor|port=${port}|json=0`));
+  add('zero-equivalent-runtime-values-ignored',
+    zeroEquivalentRuntime.every((plan) =>
+      plan.ok &&
+      plan.classification === 'LOGICAL_AGENT' &&
+      plan.state === 'LOGICAL_COLLISION_PRESERVED_ROUTE_TO_SUPERVISOR'));
+
   const realReady = planCollisionRoute('COLLISION|agent_system=real|kind=free_agent|free_hilbert=1604-1621|json=0');
   add('real-reroute-ready-with-free-address', realReady.ok && realReady.state === 'REAL_COLLISION_REROUTE_READY_DRAFT');
 
+  const freeAddressSentinels = ['-', '0', '0.0', '00', '+0', '-0', 'none', 'null', 'false'].map((free_hilbert) =>
+    planCollisionRoute(`COLLISION|agent_system=real|kind=free_agent|free_hilbert=${free_hilbert}|json=0`));
+  add('sentinel-free-addresses-do-not-unblock-real-collision',
+    [...freeAddressSentinels, planCollisionRoute('COLLISION|port=4949|free_real_address=-|json=0')].every((plan) =>
+      !plan.ok &&
+      plan.classification === 'REAL_AGENT' &&
+      plan.state === 'REAL_COLLISION_BLOCKED_NEEDS_FREE_ADDRESS'));
+
   const substring = planCollisionRoute('COLLISION|role=fireworker|json=0');
   add('boundary-token-match-no-substring',
     !substring.ok &&

tools/behcs/supervisor-collision-router.mjs.sha256

@@ -1 +1 @@
-BA2E47CFA83CA1AB0DF56ABE43493C6CD88DB6DDCFC2AFA258BCEA8A77F836DC  supervisor-collision-router.mjs
+E1B01511D0F141842805C6404921DD095753670A38B003FE0746B6B31B918D62  supervisor-collision-router.mjs